Trusted Computing Base for Kernel Code Integrity Verification
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing code integrity checks in operating systems, particularly kernel code, face challenges in accurately verifying code integrity at runtime due to interference from security mechanisms like KASLR and binary rewriting, leading to false positives and inability to detect tampering with known malware.
Innovation Solution
A trusted computing base (TCB) is established within the guest OS, coordinated by a hypervisor, which includes kernel-modifying procedures stored in a read/execute-only memory region, verified using digital signatures, and an entry point module that invokes and validates these procedures, ensuring secure kernel modifications and tamper detection.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If signature-based code integrity checks are performed at runtime, then code tampering can be detected, but false positives occur due to interference from security mechanisms like KASLR and binary rewriting
Solution Approach 1:
The patent segments the code integrity verification process into two distinct phases: load-time verification using digital signatures and hashes, and runtime verification using a trusted computing base (TCB) with measured boot process. This segmentation allows each phase to use verification methods appropriate to its timing context, avoiding the false positive problem that occurs when signature-based checks are performed at runtime after code modifications have legitimately occurred.
Solution Approach 2:
The patent implements preliminary action by establishing the trusted computing base and performing initial integrity measurements during the boot process before the operating system kernel is fully loaded and before any runtime code modifications occur. This preliminary establishment of trust anchors allows for accurate runtime verification without the interference problems that affect post-boot signature checks.
2Reliability
If signature-based integrity checks are performed at load-time only, then false positives are avoided, but the ability to detect tampering during runtime is lost
Solution Approach 1:
The patent introduces a trusted computing base (TCB) as an intermediary layer between the boot process and the operating system kernel. This TCB includes a verified bootloader and initial runtime verification mechanisms that maintain the integrity chain during runtime operations. The intermediary TCB allows the system to detect runtime tampering while preserving the reliability established by load-time signature verification.
3Adaptability or versatility
If anti-malware applications search for malicious code, then known malware can be identified, but tampering with code cannot be detected
Solution Approach 1:
The patent replaces the mechanical pattern-matching approach of anti-malware signature scanning with a cryptographic verification system based on digital signatures, hashes, and trusted computing base measurements. This substitution enables the system to detect any code modification including tampering, not just known malware patterns, by verifying the cryptographic integrity of code against its original trusted state.
Data Source
AI summary
One or more kernel-modifying procedures are stored in a trusted computing base (TCB) when bringing up a guest operating system (OS) on a virtual machine (VM) on a virtualization platform. When the guest OS invokes an OS-level kernel-modifying procedure, a call is made to the hypervisor. If the hypervisor determines the TCB to be valid, the kernel-modifying procedure in the TCB that corresponds to the OS-level kernel-modifying procedure is invoked so that the kernel code can be modified.